JUMPSEC recovered source code and malware from a BlueNoroff platform that impersonates Zoom and Microsoft Teams meetings, profiles cryptocurrency wallets, and delivers ClickFix payloads to Windows and macOS victims. Operators approached targets through hijacked Telegram accounts belonging to trusted industry contacts, streamed victims' webcams, and used prerecorded synthetic video and staged SDK errors to induce command execution. The Windows chain deployed a VBScript implant classified as NukeSped, while the macOS chain stole Chrome keychain material and exfiltrated it through Telegram. JUMPSEC attributed the operation to BlueNoroff with high confidence based on infrastructure, tooling, victimology, malware, and overlap with prior reporting.